Multiple critical vulnerabilities have been disclosed in SEPPMail Secure E-Mail Gateway, an enterprise-grade email security and secure mail transfer solution widely used across enterprise environments.

According to public reporting and security research disclosures, the identified vulnerabilities could allow unauthenticated attackers to achieve remote code execution (RCE), bypass authorization controls, access sensitive mail traffic, and potentially gain full control of affected appliances.

Security researchers from InfoGuard Labs reported that successful exploitation may enable attackers to:

• Read or intercept enterprise email traffic.
• Gain unauthorized access to sensitive internal communications.
• Execute arbitrary code remotely.
• Use the vulnerable appliance as an entry point into internal corporate networks.

Given the critical nature of the vulnerabilities and the role of secure email gateways within enterprise infrastructure, organizations using affected SEPPMail versions should prioritize immediate remediation and monitoring.

About the Vulnerabilities

Vulnerability Identifier/CVSS Scores

• CVE-2026-2743 — 10.0 (Critical)
• CVE-2026-7864 — 6.9 (Medium)
• CVE-2026-44125 — 9.3 (Critical)
• CVE-2026-44126 — 9.2 (Critical)

Vendor + Component Impacted:

SEPPMail Secure E-Mail Gateway

Discovery Timeline:

The vulnerabilities were publicly disclosed in 19 May 2026 following coordinated research and analysis conducted by InfoGuard Labs researchers.

Security updates have since been released by SEPPMail to address the affected components.

Technical Overview:

The vulnerabilities impact multiple components within the SEPPMail Secure E-Mail Gateway platform, including:

• Large File Transfer (LFT) functionality.
• GINA User Interface components.
• Authorization and session validation mechanisms.
• Unsafe deserialization functionality.

The most critical vulnerability, CVE-2026-2743, is a path traversal issue within the LFT feature that may allow arbitrary file write operations, ultimately leading to remote code execution.

Additionally:

• CVE-2026-44125 allows unauthorized access to protected functionality due to missing authorization checks.
• CVE-2026-44126 enables remote code execution through unsafe deserialization of untrusted data.
• CVE-2026-7864 exposes sensitive environment variables through an unauthenticated endpoint.

These vulnerabilities could potentially allow attackers to compromise the email gateway appliance, intercept sensitive communications, establish persistence, and pivot further into internal enterprise infrastructure.

Impact:

• Remote Code Execution (RCE).
• Unauthorized access to enterprise mail traffic.
• Exposure of sensitive emails and attachments.
• Appliance takeover and persistence.
• Internal network compromise.
• Credential theft and lateral movement.
• Deployment of ransomware or additional malware payloads.
• Security monitoring evasion through compromised gateway infrastructure.

Because secure email gateways often process sensitive business communications and operate at strategic network locations, compromise of these systems may have severe enterprise-wide impact.

Official Mitigation Guidance:

SEPPMail has released patched versions addressing the disclosed vulnerabilities.

Organizations are advised to:

• Upgrade immediately to the latest patched SEPPMail versions.
• Ensure version 15.0.4 or later is deployed where applicable.
• Review appliance exposure to the internet.
• Restrict administrative interface access.
• Monitor gateway logs for suspicious activity.
• Conduct compromise assessments for exposed systems.
• Validate integrity of email routing and filtering configurations.

SharkStriker Recommendations

SharkStriker recommends the following immediate actions:

• Identify all SEPPMail Secure E-Mail Gateway deployments across the environment.
• Apply the latest vendor security patches immediately.
• Review external exposure of administrative and user interfaces.
• Monitor for abnormal authentication attempts and suspicious appliance behavior.
• Investigate unauthorized file creation, execution, or configuration changes.
• Conduct threat hunting for indicators associated with unauthorized appliance access.
• Enforce network segmentation and least privilege access controls.
• Perform compromise assessment activities on internet-facing appliances.

SharkStriker Actions

As part of our proactive security operations:

• Continuous monitoring of emerging threat intelligence related to SEPPMail vulnerabilities, exploitation attempts, and proof-of-concept discussions.
• Validation of detection coverage and monitoring visibility across managed customer environments for suspicious email gateway activity.
• Proactive threat hunting focused on remote code execution indicators, unauthorized access attempts, abnormal file operations, and privilege escalation behaviors.
• Correlation of telemetry, authentication events, network activity, and appliance-level anomalies associated with email infrastructure compromise attempts
• Continuous monitoring for exploitation patterns targeting enterprise email security infrastructure and internet-facing communication services.

Through advanced detection engineering, behavioral analytics, threat intelligence correlation, and proactive monitoring, STRIEGO enhances enterprise visibility and supports rapid identification of suspicious activities before escalation into major security incidents.